Threats tagged 'drupal-contrib-2026-312'

The Mime Mail module for Drupal allows sending HTML email messages. Under rare configurations, a user able to send HTML emails could expose non-public files uploaded to the site by including them in emails. Exploitation requires the attacker to have prior knowledge of the uploaded files and the ability to send HTML emails to chosen recipients. A fix is available in version 2.0.4.